Every region has different rules for how a SaaS deploying LLMs in production must handle data. This guide is the practical playbook — what each regulator actually requires, what Kunavo does and does not provide, and what you still need to do on your side. It's not legal advice (talk to a lawyer for that), but it's the operational checklist most engineering teams actually need.
The universal four — applies everywhere
- Pseudonymize PII before sending to LLM upstreams — never send raw names, emails, phone numbers, account numbers to a third party. Mask with stable tokens, restore locally
- Sign a DPA / data processing agreement with every processor that handles personal data. Kunavo does not offer one — requests are processed in the US and forwarded to upstream providers — so for a DPA covering LLM calls, contract with the model provider directly (Anthropic, OpenAI or Google enterprise terms)
- Maintain an audit trail — request ID, model used, prompt hash, token counts, timestamp. Logs must be deletable for right-to-erasure requests
- Update your privacy policy — explicitly mention AI processing, list sub-processors (Kunavo + upstream providers)
Region-specific requirements
🇪🇺 European Union — GDPR (general)
- Article 28 DPA with each processor — Kunavo does not offer one; for LLM calls, contract with the model provider directly (Anthropic, OpenAI or Google enterprise terms)
- Standard Contractual Clauses (SCC) for transfers to US-based upstreams (Anthropic, OpenAI) — they come with the provider's own DPA; Kunavo has no EU region and processes requests in the US
- Records of processing activities (Art. 30) including LLM-specific purposes
- Privacy by design — pseudonymization, data minimization, purpose limitation
- 72-hour breach notification timeline if a security incident affects EU subjects
🇩🇪 Germany — DSGVO + Impressum + DDG
Germany layers extra requirements on top of GDPR:
- Impressum (§ 5 DDG / § 18 MStV) — publish operator identity, address, contact, supervisory authority. Mandatory for German-targeted sites. Kunavo's own Impressum is at /legal/impressum
- Stricter consent for "non-essential" data processing (Cookie consent, analytics)
- For B2B sales: reverse-charge rules apply intra-EU. Kunavo's standard checkout neither shows VAT nor collects a VAT ID; for a bookkeeping document, write to contact@kunavo.com
DSGVO-konformer LLM-Einsatz has the German-language deep dive with PII-masking code.
🇫🇷 France — RGPD + AI souveraineté concerns
- RGPD is GDPR; same Article 28 DPA applies
- CNIL is the enforcement authority; expect closer scrutiny for health/finance
- For sensitive sectors (public, health, defense): consider EU-only routing — e.g. Mistral, contracted directly; Kunavo has no EU region and does not offer EU-only routing
- Privacy policy must be in French if servicing French consumers
Conformité RGPD pour LLM en France for the French deep dive.
🇯🇵 Japan — APPI + tokutei-shoutorihiki
- 特定商取引法 (Act on Specified Commercial Transactions): publish seller info, refund policy, payment methods. Mandatory for B2C in Japan. Kunavo's page at /legal/tokutei-shoutorihiki
- APPI (Personal Information Protection Act) — Kunavo does not sign data processing agreements; for a contract covering LLM processing, go to the model provider directly
- Cross-border transfer to US/EU upstreams requires consent or contract
🇰🇷 South Korea — PIPA
- Korean Personal Information Protection Act — one of the strictest globally
- Explicit consent for collection and cross-border transfer
- Korean-language privacy notice if servicing Korean users
🇧🇷 Brazil — LGPD + BACEN for fintech
- LGPD (Lei Geral de Proteção de Dados) mirrors GDPR structurally
- For PIX / payment use cases, BACEN Circulars 4.018 + 3.978 on operational risk apply — document model decisions, allow contestation
- Direito ao esquecimento (Art. 17) — your logs must be deletable
Claude para análise de risco PIX no Brasil covers LGPD + BACEN specifically.
🇹🇷 Turkey — KVKK
- Personal Data Protection Law (KVKK) — DPA structure similar to GDPR
- Foreign data transfer requires explicit consent or KVKK-approved safeguards
- Data controller must register with KVKK if processing exceeds thresholds
Zero Data Retention (ZDR) — when you need it
By default, Anthropic logs prompts for 30 days, Google for 60 days, for abuse monitoring. For high-sensitivity workloads (health, financial, government, EU public sector), the model providers offer ZDR under their own enterprise terms. Kunavo does not offer ZDR, so each of these is a direct contract with the provider:
- Anthropic ZDR: for Anthropic enterprise customers. Anthropic deletes prompts within 30 seconds of completion, no training, contractual commitment
- Google Vertex AI ZDR + EU region: routing to europe-west1 (Belgium) or europe-west4 (Netherlands), data stays in EU, ZDR available
- OpenAI ZDR: Enterprise tier only
Requests sent through Kunavo are processed in the US and forwarded to upstream providers, whose own data-retention policies apply; Kunavo cannot switch on ZDR or EU-region routing for them. A workload that needs either belongs on a direct contract with the model provider.
What Kunavo provides vs what stays on your side
| Responsibility | Kunavo | You |
|---|---|---|
| DPA with the model provider | Not offered | ✓ (direct contract with the provider) |
| PII pseudonymization in prompts | ✓ | |
| Request-level audit logs | ✓ (Kunavo side) | ✓ (your side) |
| ZDR or EU-region routing | Not offered | ✓ (provider enterprise terms) |
| Privacy policy mentioning sub-processors | ✓ | |
| Right-to-erasure on your data | ✓ | |
| Bookkeeping document for a top-up | Write to contact@kunavo.com |
The 30-minute audit checklist
- Need a DPA for LLM calls? Kunavo does not sign one — contract with the model provider directly (Anthropic, OpenAI or Google enterprise terms)
- Add PII pseudonymization step before every LLM call (template code in the region-specific deep dives)
- Confirm your audit log captures request_id, prompt_hash, model, tokens, timestamp — and is deletable
- Update privacy policy: list "Kunavo" + upstream providers as sub-processors, mention purposes (classification, generation, etc.)
- Publish region-specific notices: Impressum (DE), tokutei-shoutorihiki (JP) — Kunavo's own notices at /legal show the format
- If sensitive sector: arrange ZDR directly with the model provider (Kunavo does not offer it)
- Set monthly review cadence — regulations evolve, vendors evolve, your audit log retention may need adjustment
Don't panic, but don't skip
For most B2C SaaS with no special-category data, the universal four + an updated privacy policy gets you 95% there. The remaining 5% — sector-specific notices, ZDR, sovereign upstreams — kicks in when you scale or move into regulated industries.
Frequently asked questions
Does Kunavo sign a DPA (data processing agreement)?
No. Kunavo does not offer a GDPR Article 28 data processing agreement, Standard Contractual Clauses or EU data residency. Requests are processed in the US and forwarded to upstream model providers, whose own privacy and data-retention policies govern what they do with the content. A team that needs a DPA should contract directly with the model provider under Anthropic, OpenAI or Google enterprise terms.
How long do LLM providers retain prompts by default?
By default Anthropic logs prompts for 30 days and Google for 60 days, for abuse monitoring. Zero Data Retention removes that window but has to be arranged directly with each model provider; Kunavo does not offer it.
How do I get Zero Data Retention (ZDR) for LLM API calls?
Contract with the model provider directly: Kunavo does not offer Zero Data Retention, because requests sent through it are processed in the US and forwarded to upstream providers under their own retention policies. Anthropic offers ZDR to its enterprise customers and then deletes prompts within 30 seconds of completion, with no training and a contractual commitment. Google Vertex AI offers ZDR with EU-region routing to europe-west1 (Belgium) or europe-west4 (Netherlands). OpenAI ZDR is Enterprise-tier only.
What is the minimum compliance work for shipping an LLM feature?
Four things apply in every region: pseudonymize PII before it reaches an LLM upstream, sign a data processing agreement, keep an audit trail (request id, model, prompt hash, token counts, timestamp) that can be deleted for right-to-erasure requests, and update the privacy policy to name AI processing and list sub-processors. For most B2C SaaS with no special-category data, those four plus a DPA cover about 95% of the requirement.
Which countries require notices beyond GDPR for an AI product?
Germany requires an Impressum under § 5 DDG / § 18 MStV. Japan requires a 特定商取引法 notice publishing seller identity, refund policy and payment methods for B2C. South Korea's PIPA requires a Korean-language privacy notice and explicit consent for cross-border transfer. Brazil's LGPD adds BACEN Circulars 4.018 and 3.978 for PIX and payment use cases. Turkey's KVKK requires explicit consent or KVKK-approved safeguards for foreign data transfer.